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Enums 


True if 1, else false 





DataType : Byte 
Double 
Float 
Int32 
Int64 
Boolean 
Variable 
String 
Instance 
Int16 = 0x0f 
InstanceType : Intl6 
StackTopOrGlobal = 0 


Self = -1 
Other = -2 
All = -3 
Noone = -4 


Global = -5 
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Unknown = -6 // TODO 
Local = -7 // script-scope local var 
ObjectSpecific // anything > 0 //If it's none of the given values, it represents a GameObjectIndex 
VariableType : Byte 
Array 
StackTop = 0x80 
Normal = 0xA0 
Unknown = 0xE0O // room-scope vars? (only found in RoomCC stuff) 
ComparisonType 
LowerThan = 1 
LTOrEqual = 2 
Equal = 3 
Inequal = 4 
GTOrEqual = 5 
GreaterThan = 6 


Architecture 


The interpreter is stack-based. Data is pushed and popped from the stack. 


Variables and arrays 


When parsing a Variable, if the Type is VariableType.Array: the index is at the stack top and has to be popped, and is followed by the Int16 -5, which 
also has to be popped. When an array is pushed and the Dup instruction occurs, the index is also duplicated. When Pop's or Push's InstanceType is 
InstanceType.StackTopOrGlobal, if Type is VariableType.StackTop then one additional value, representing the instance, will be popped from the 
stack. 


References 


Each ReferenceDefinition has a pointer to memory address of the first instruction that accesses it. In the second block of the instruction, there is the 
offset (calculated in blocks, not bytes) to the next occurrence of the reference. Note that the Type of the reference can change between different 
instances of said reference; for instance in one case an array item can be accessed, while in case the same array is accessed as a whole. Functions don't 
have a Type, only the offset to the next occurrence. 


Instructions 


Each instruction is composed of one or more 32-bit blocks. The most significant byte is the opcode. 


Reference 
Type : VariableType 
NextOccurrenceOffset : Int24 
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Variable : Reference 
DoubleTypeInstruction 
padding : Intl6é 
Types : TypePair 

OpCode : Byte 
ComparisonInstruction 
padding : Byte 
Comparison : ComparisonType 
Types : TypePair 
OpCode : Byte 
SingleTypeInstruction 
padding : Intl6é 
Type : DataType 
OpCode : Byte 
GotoInstruction 
Offset : Int24 
OpCode : Byte 


For bytecode version OxE, the opcode table is as follows: 


0x03: Conv : DoubleTypeInstruction //Push((Types.Second) Pop) 


0x04: Mul : DoubleTypeInstruction //Push(Pop() * Pop()) 

0x05: Div : DoubleTypeInstruction //Push(Pop() / Pop()) 

0x06: Rem : DoubleTypeInstruction //Push(Pop() % Pop()) 

0x06: Rem : DoubleTypeInstruction //Push(Remainder(Pop(), Pop())) 
0x07: Rem : DoubleTypeInstruction //Push(Pop() % Pop()) 

0x08: Add : DoubleTypeInstruction //Push(Pop() + Pop()) 

0x09: Sub : DoubleTypeInstruction //Push(Pop() - Pop()) 

OxOa: And : DoubleTypeInstruction //Push(Pop() & Pop()) 

Ox0b: Or : DoubleTypeInstruction //Push(Pop() | Pop()) 

OxOe: Not : DoubleTypeInstruction //Push(!Pop() ) 

Ox1l: Slt : DoubleTypeInstruction //Push(Pop() < Pop()) 

0x12: Sle : DoubleTypeInstruction //Push(Pop() <= Pop()) 

0x13: Seq : DoubleTypeInstruction //Push(Pop() == Pop()) 

0x14: Sne : DoubleTypeInstruction //Push(Pop() != Pop()) 

0x15: Sge : DoubleTypeInstruction //Push(Pop() >= Pop()) 

0x16: Sgt : DoubleTypeInstruction //Push(Pop() > Pop()) 

0x41: Pop //Instance.Destination = Pop(); //ATTENTION: if Types.First is Int32, the value will be on top of the stack, even 
before array access parameters! 

L Block1 


Types : TypePair 
Instance : InstanceType 
OpCode : OpCode 

Block2 

_pestination : Variable 


0x82: Dup : SingleTypeInstruction //Push(Peek() ) 
Ox9d: Ret : SingleTypeInstruction //return Pop() 
Ox9e: Exit : SingleTypeInstruction //return; 
Ox9f: Popz : SingleTypeInstruction //Pop(); 
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Oxb7: B : GotoInstruction //goto Index + Offset*4; 
Oxb8: Bt : GotoInstruction //if (Pop()) goto Index + Offset*4; 
Oxb9: Bf : GotoInstruction //if (!Pop()) goto Index + Offset*4; 


Oxbb: Pushenv : GotoInstruction 
Oxbc: Popenv : GotoInstruction 
OxcO: Push //Push(Value) 


Value : Variant //Depends on Type. Types longer than Int1l6 take one or more extra blocks. 
Instance type is an Intl6 in Blockl and the Reference is in Block2 


Type : DataType 
OpCode : OpCode 
Oxda: Call //Function(argg, argy, 
L Block1 
ArgumentsCount : Intl6 
ReturnType : DataType 
OpCode : OpCode 
Block2 
Function : Reference 


Oxff: Break //Invalid access guard? 


Type : DataType 


ar : Int16 
OpCode : OpCode 


The following is valid for version OxF: 


0x07: Conv : DoubleTypeInstruction //Push( (Types.Second) Pop) 


0x08: Mul : DoubleTypeInstruction 
0x09: Div : DoubleTypeInstruction 
OxOA: Rem : DoubleTypeInstruction 
Ox0B: Mod : DoubleTypeInstruction 
Ox0C: Add : DoubleTypeInstruction 
Ox0D: Sub : DoubleTypeInstruction 
OxOE: And : DoubleTypeInstruction 
OxOF: Or : DoubleTypeInstruction / 
0x10: Xor : DoubleTypeInstruction 
Oxll: Neg : SingleTypeInstruction 
0x12: Not : SingleTypeInstruction 
0x13: Shl : DoubleTypeInstruction 
0x14: Shr : DoubleTypeInstruction 
0x15: Cmp : ComparisonInstruction 


0x45: Pop //Instance.Destination = 
before array access parameters! 
L Block1 
Types : TypePair 
Instance : InstanceType 
OpCode : OpCode 
Block2 
_pestination : Variable 


// NOTE: a "magic array pop" instruction (06 00 5F 45) indicates something unknown as of yet. 
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«e+, Aarg,) where arg = Pop() and n 
//Push(Pop() * Pop()) 

//Push(Pop() / Pop()) 
//Push(Remainder(Pop(), Pop())) 
//Push(Pop() % Pop()) 

//Push(Pop() + Pop()) 

//Push(Pop() - Pop()) 

//Push(Pop() & Pop()) 

/Push(Pop() | Pop()) 

//Push(Pop() * Pop()) 
//Push(-Pop()) // two's complement 
//Push(~Pop()) // one's complement 
//Push(Pop() << Pop()) 
//Push(Pop() >>= Pop()) 


//Push(Pop() ~cmp~ Pop()) // The actual comparison depends on the ComparisonType 
Pop(); //ATTENTION: if Types.First is Int32, the value will be on top of the stack, even 


If Type is Variable, the 


ArgumentsCount 
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0x86: Dup SingleTypeInstruction //Push(Peek() ) 
Ox9C: Ret SingleTypeInstruction //return Pop() 
Ox9D: Exit : SingleTypeInstruction //return; 
Ox9E: Popz : SingleTypeInstruction //Pop(); 
OxB6: B : GotoInstruction //goto Index + Offset*4; 
OxB7: Bt : GotoInstruction //if (Pop()) goto Index + Offset*4; 
OxB8: Bf : GotoInstruction //if (!Pop()) goto Index + Offset*4; 
OxBA: PushEnv : GotoInstruction 
OxBB: PopEnv : GotoInstruction 
OxcCO: PushCst //Push(Value) // push constant 
OxCl: PushLoc //Push(Value) // push local 
OxC2: PushGlb //Push(Value) // push global 
OxC3: PushVar //Push(Value) // push other variable 
0x84: PushI16 //Push(Value) // push int16 
// NOTE: the push type is preserved from the previous version, so the program can check for any of these values instead of 
every kind separate and then checking the actual type 
Value : Variant //Depends on Type. Types longer than Int16 take one or more extra blocks. If Type is Variable, the 
Instance type is an Intl6 in Blockl and the Reference is in Block2 
Type : DataType 
OpCode : OpCode 
OxD9: Call //Function(argg, arg ,, .--, Aargyn) where arg = Pop() and n = ArgumentsCount 
L Block 
ArgumentsCount : Intl6 
ReturnType : DataType 
OpCode : OpCode 
Block2 
Function : Reference 
OxFF: Break //Invalid access guard? 
Signal : Int16 
Type : DataType 
OpCode : OpCode 


After parsing 


If you want to decompile the code in high level language, you'll have to do some structuring. Some graph theory is required to get good output. There 
are while, do..while, for loops and special Repeat statements (essentially For loops without declared variables); no improper loops, but breaks and 
continues. There are ifs, if..else's and switch..case's. Also considering that there are returns and exits, you'll have to heuristically simulate the stack and 
branch it when the control flow breaks. For any questions or if I've made mistakes, message me on Reddit. 
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